The Dimitri Grassi Salon booking system contains a missing authorization vulnerability (CVE-2025-32220) that arises from incorrectly configured access control security levels. This flaw affects versions up to and including 10.30.23 and could allow an attacker with limited privileges to perform unauthorized actions, impacting integrity and availability. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges, no user interaction, unchanged scope, no confidentiality impact, but integrity and availability impacts are low and low respectively.

The vulnerability can lead to unauthorized modification or disruption of the salon booking system's operations due to missing authorization checks. Confidentiality is not impacted. The medium severity reflects the potential for limited integrity and availability impacts. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor for vendor updates. Until a fix is available, restrict access to the affected system to trusted users and review access control configurations to minimize risk.